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SUBJECT: Management Alert; interna! Control Weaknesses Identified in OTR's Processing of Re- 
ceipts from the Collections Division's Post Office Box ( I A:OTR:290?:C 1 2( 1 ) 



The Office of Integrity and Oversight (OfO) is currently perfor ming a review of the Office of Tax and 
Revenue (OTR) Compliance Administration Collections Division's (CD's) monthly collections data re- 
ported for the period October 1 , 2005 through October 3 1 , 2008, As part of this review, w e conducted a 
"walk-through" of the collections receipts process within CD. In our walkthrough, we identified several 
weaknesses in the system of internal controls for the processing of receipts by CD. This management 
alert provides our findings and four recommendations to improve the sy stem of internal control for these 
receipts. 

OIO determined thai CD did not have functioning internal controls to safeguard the receipts from the CD 
Post Office Box {POB), Further , controls were not in place to assure that the revenue officers (ROs) and 
tax examiners {J fin) processed POB receipts in compliance with the Office of the Chief Financial Offi- 
cer's (OCFO's) policy of two days from the date of receipt of the funds. 

Background 

CD maintains a separate POB from that of the Returns Processing Administration (RPA) to collect tax 
receipts from individuals who have: (i) been referred to CD for delinquent payment of taxes, 1 and (ii) as- 
signed to a specific RO or TF for collection action. Further, the POB takes in receipts from those laxpav- 
ers whose delinquent accounts have been assigned to a debt collector, under contract with CD. Addition- 
ally, the POB prov ides a location for taxpayers to mail correspondence to CD or a specific RO or 1 1 

The CD asserts that the POB allows them to better track the progress of their collection efforts, as a 
whole, and the collection efforts of a specific RO or TF. T hey further assert that the POB allows them to 
ensure that the funds received are identified as collections and credited to the proper taxpayer account, in 
cases where a taxpayer has multiple delinquent accounts. Furthermore. CD asserts by having the RO or 



The term tax, for litis memorandum. does not include lines on real property: which are processed through the Real 
Property lav Administration. 
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1 1 complete the payment posting voucher (PPV) litis reduces the time necessary to process individual 
payments within RPA. as the research work is already done and the RO or 1 1 identified the proper ac- 
counts) for crediting. 

I he POB is the largest single receipt point for collections. With the exception of late returns CP asserts 
that the majority of the delinquent tax receipts come through the POB. 

Absence of Controls for POB Receipts 

(HO found the absence of a functional system of internal controls and procedures for the in-coming re- 
ceipts and tracking of tax payments received through the POB. Taxpayer payments were not separately 
identified and tracked until the RO or 1 1, delivered the payment to RPA for processing. We found that 
there was no system in place to ensure that all payments received on a specific date were distributed to the 
collection teams, processed as a contractor collection, or referred to a team or specific individual for reso- 
lution of a payment issue or question. 

A sole clerical assistant (t A) is responsible for the pickup of the mail receipts, sorting and delivering 
(hose receipts to the respective collection teams, and processing the payments generated by the CD debt 
collection contractors. This function is rotated on a weekly basts among the C.A's assigned" to the Collec- 
tions Div is ion. 

The current system does not follow the receipts from collection at the post office through final processing 
in the integrated tax system (ITS). Envelopes containing potential receipts are not logged or opened to: 
(i) determine whether they contain taxpayers" receipts, and (it) the amount of the receipts. CD does not 
restrictively endorse checks"* as they are received, instead the checks are not endorsed until they reach 
RPA for processing. The current process may require the cheek to pass through five different individuals 
before it is endorsed and tracked in RPA. This significantly increases the chances for the pay ment to be 
lost, manipulated, or diverted by a number of different individuals. The current system does not provide 
accountability for the receipts, and the only individuals that CD can reasonably assure were involved in 
the processing, are the CAs who sort and distribute the receipts from the POB. 

Internal controls over cash receipts are fundamental to management's accountability over cash and a basic 
requirement to "best practices'" of management oversight. Without controls in this area, an organiza- 
tion's management has no assurance that it is receiving all of the payments directed to it. The U.S. Gov- 
ernment Accountability Office (GAO). in its publication Internal Control Standards in the Federal Gov- 
ernment (Standards), discusses the objectives of a system of internal controls. They state in part:' 

".•J subset of these objectives is the safeguarding of assets. Internal control should be designed to provide 
reasonable wnuranar rvgarthng-thr-prevemion -nfw prompt detection 7^jtn<nnfton:edacymsi7ion7We. or 

disposition of agency's assets " 



GAO also addresses the issue of controls for vulnerable assets in stating that: 



Ihe term checks for the purposes of this memorandum include persona! and business checks, money orders, eash- 
ier and treasurer's checks, certified checks and other negotiable instruments, It does not include payments made in 
currency and coin. 

' t j ' S Government Accountability Office, formerly the U.S. General Accounting Office: Internal Control Stamfords 
lor the Federal Government; Report Number: GAO AIM D-00.2 f J. I : November IW, page 5. 

' Ibid: page 1 5. 
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"4eees\ in resources and mWi sfnmld he limited !•> atnh<>ri:cd individuals, and aceoimnihilirv tor their 
cuMody and ti\t: should he assisted and maintained Periodic eomparison of resources »t ith the recorded 
accountability shouU he made no help reduce the risk of emirs, fraud, misuse, or unauthorized alteration " 

Based on the system in place in Mas 2004. i f) cannot pros ide a reasonable assurance that aii FOB re- 
ceipts are properly safeguarded, that the ROs and i I •> process the receipts pros ided to them in accordance 
ss ith Oil n policy, and that all other receipts receised through the FOB are processed timely. V e \hunci 
a more than remote possibility that payments could be lost, or manipulated with only a vers limited pos- 
sibility of detection by another CD employee. 

The folkming describes the weaknesses we noted during our "walk-through" of the FOB receipts process; 

/. Absence of Documentation to Support the Controls of Taxpayer Receipts 

OK.) found that CD does not effectively document its FOB receipts until the RO or I I sends the indisid- 
ual receipt and payment to RPA for processing. As noted before, this may take several days and the pa\- 
ment mas pass through as main as five individuals without documentation. Only the CA who is respon- 
sible for the sorting and delivering of mail can be definitively determined, through the CD assignment 
sheet. The current CD process relies on the veracity of the individuals who receive the payments and the 
subsequent timely processing of those payments. The current practices provide more than a remote op- 
portunity for payments to be lost, delayed in processing, cr intentionally diverted. 

The CA is not required to enter the payment data into a paper or electronic log or to identify specific 
payments that are sent to ROs and TEs within the various teams, This entire process is generally done 
solely by the individual CA with limited oversight. Sole responsibility for assuring that all PQB receipts 
receised that day are processed by the close of their tour of duty . 

Once the mail has been delivered to the CA who supports the specific collection teams, the CA distributes 
the mail to the respective individual RO or I E for processing and preparation of a PPV for the payment 
they received. The RO or 1 1 , may make copies of the payments received and the resulting PPV for their 
records: however, this is not required by CD. The RO or IT may return the check and PPV to the CA or 
deliver it directly to RPA for processing. The only records maintained to this point are those voluntary- 
records held by the individual RO or 1 1, for the delinquent accounts they have been assigned. Further, 
until the receipt is entered into ITS by RPA. there is no formal record of the payment. 

A basic tenet of a functional system of internal control for taxpayer checks is that control and tracking of 
the checks be established as soon as feasible and that controls for the handling and processing of the re- 
ceipts be documented throughout the process. These controls provide an accountability trail of the indi- 
vidual^) responsible for processing the receipt and provide a reasonable assurance of the time it takes to 
process an individual receipt. Accountability for payments is a critical component of any internal control 
system for cash receipts, Further, restricting access to the payments and the processing for those pay- 
ments minimizes the chances for inadvertent or intentional loss of the payment or errors identifying the 
payment and the correct account to which it should be charged. 
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2. Inadequate Separation of Duties 

OK) noses that the duties for processing the pax merits received from the POB rests sole!) with the CA 
who picks tip the mail. Currently, a CA from CD is assigned on a weekly basis to: 

• pick-up the mail from the POB. 

• sort the mail for processing b\ the collection teams; 

• deliver the sorted mail to the CA who supports the specific collection team: 

• open the mail whose destination cannot be determined from the envelope and sort the mail to the ap- 
propriate col lection team; 

• open the mail from collection accounts, prepare PPVs for the payments received from taxpayers, and 
deliver the payments to RPA for processing; and 

• resolve, with a supervisor, any questions regarding to whom a payment or correspondence should be 
referred. 

It appears that no other individual verities that all the payments received during a specific dav have been 
appropriately distributed or that the PPVs are prepared. When a large number of payments are received, 
it appears that the CA is responsible for notifying a superv isor and requesting assistance to process the 
payments. The current process places almost exclusive reliance on the CA and does not account for er- 
rors in the processing of the mail which may significantly delay the processing of a taxpayer's payment 
I ttrthcr, the process does not prov ide reasonable assurance that all the payments received have been proc- 
essed. 

Separation of duties is a critical component of any- sy stem of internal control. GAO in its Standards pub- 
lication states 5 : 

Key Junes ami respotisihihties need to be divukd at sexy coated among different people in i * din e the nsk 
of emir or fraud this- sfiould include separating the responsibilities far authoi izing iransac turns priKi s\ 
niii and nxordaii; them review ntii the transatlions. and tiandfim; an\ related assets \u one individual 
should control all kev aspects: of a transaction or event. ' 

By separating duties CD management can provide reasonable assurance that all payments received 
through the POB are initially recorded and distributed to the collection teams for further processing. The 
separation allows for the responsibility for sorting and processing payments over a number of individuals, 
effectively spreading the workload among several indiv iduals and not placing it solely in the hands of a 
single individual. 

3. Restrictive Endorsement of Taxpayer's Payments 

CD's POB receipt processing does not require the restrictive endorsement of a taxpayer's payment upon 
receipt, OK.) found that payments were not endorsed until the check was processed bv RPA in some 
cases this could be several days later. As we previously slated, a payment received through the POB niaj 
pass through up to five individuals without being restrictive!) - endorsed. This process increases the poten- 
tial for the check to be negotiated bv an individual, who is not authorized to do so, and increases the pos- 
sibility that should a check be lost or misplaced it could be negotiated b> an unauthorized indiv idual. 
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One of the fundamental principles of a sound system of internal controls is to protect vulnerable assets 
from unauthorized use or manipulation, or being unaccounted for. Placing restrictive endorsements on 
individual checks limits the ability of an indh idual to improperly negotiate a payment. 

Revmmnendadon s 

We recommend that the Director of the Compliance Administration implement the following recommen- 
dations to establish a reliable s\ stem of internal controls o\ er OTR's POB receipts; 

1. Develop a system that tracks the taxpayer's payments from the initial receipt from the POB through 
turning over the checks and related PPV to the RPA for processing. This system should pan ide for a 
separation of duties so thai no single individual can control the entire transaction stream. 

2. Develop a database or spreadsheet application to log receipts from the POB, This application should 
contain fields to capture the (i) taxpayer's name, (it) taxpayer identification number or account num- 
ber, (iii) the specific account that the payment is to be credited to, (iv) amount of the payment: (v) 
date the payment was received; and (vi) the RO. IE. or team to whom the payment was given. 

3. Require that the CA sorting the mail from the POB to enter the payments into the database spread- 
sheet as the mail is being sorted. 

4. Require that all checks be restrietively endorsed at the point of initial receipt bv the CA processing 
the POB receipts. 

Please provide a response to this Management Alert within fifteen (15) business days of receipt of this 
memorandum report. If you have any questions, please contact Mohamad YtisufT. Internal Audit Director 
at 442-8240. or Tisha Edwards. Audit Manager, at 478-9143. 

cc: Glen Groff, Director of Operations. OTR 

Bedell Terry, Director of Compliance. OTR 
Portia Perry, Chief of Collections. OTR 
Mohamad YusufT, Internal Audit Director. OIO 
Nelson Alii, Senior Manager. OIO 
Tisha Edwards, Audit Manager. OIO 
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GOVERNMENT OF THE DISTRICT OF COLUMBIA 
Office of the Chief Financial Officer 
Office of Tax and Revenue 
★ ★ ★ 




Stephen M. Cordi 

Deputy Chief Financial Officer 



MEMORANDUM 




TO: 



Robert G. Andary, Executive D^spfofl/^ 
Office of Integrity^nd^^er«^^®K)) 



FROM: 



Stephen M. Corai 
Deputy ChiefFini 



DATE: July 17, 2009 

SUBJECT: Management Alert: Internal Control Weakness Identified in OTR's 

Processing of Receipts from the Collection Division's Post Office Box 

(IA:OTR:2907:C12(1) 

This is in response to your memorandum dated May 29, 2009, Report Number 
IA:OTR:2907:C13(1) in which you state that you identified an Internal Control 
Weakness in the Collection Division Processing of Receipts from its Post Office box. 

We reviewed your report and agree with the conclusions. 

In order to provide better separation of duties and insure the integrity of the receipt and 
accounting of payments we have revised the entire process as it relates to the PO Box for 
the Collection Division. The mail in the PO Box will no longer be picked up by the 
Collection Division. This responsibility has now been assigned to the Returns Processing 
Division. The new procedures will consolidate the receipt and processing of all mail in 
one place. The new procedures should also result in shorter deposit time for subsequent 
payments received by OTR from delinquent taxpayers. These procedures will be fully 
implemented by July 24, 2009. 

A copy of the new procedures is attached for your information. If you have any 
questions or require additional information regarding our response or progress towards 
implementation please call me or have a member of your staff contact Glen Groff, 
Director of Operations, at (202) 442-6499. 

cc: Glen Groff, Director of Operations, OTR 

Bedell Terry, Director of Compliance Administration, OTR 

Portia Perry, Chief of Collections, Compliance Administration, OTR 

Mohamad Yusuff, Internal Audit Director, OIO 

Nelson, Alii, Senior Manager, OIO 

Tisha Edwards, Audit Manager, OIO 
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PAYMENT PROCESSING 



A/R and Compliance Payment Processing 

Background: Generally, taxpayers are mailing in payments for Accounts 
Receivables (A/R) or bills using one of the following methods: 

1. Mailing in the payment with the bill (A/R) to the address on the bill which 
directs the mail to PO Box 419 

2. Send the payment with the bill (A/R) or note to the 941 N. Capitol St address 

3. Send the payment to PO Box 37759 which is the address provided for cases 
being handled by Collection. 

4. Taxpayers also send payments to PO Box 556 which is designated for use for 
Audit work. 



PO BOX 


RETURN/DOCUMENT IDENTIFICATION 


419 


Revenue Officer's work - RPA Pick Up 


556 


Audit Division - RPA Pick up 


37759 


Collection Pick Up 




941 North Capitol St Address (white mail) 



Payments received through PO Box 419, PO Box 556 and the 941 North Capitol St 
address is picked up daily by RPA and subjected to normal extraction and sorting. 
All mail addressed to a specific person or regarding a specific case is copied and 
forwarded to Compliance. Checks and the attachments are forwarded to Code and 
Edit Unit for additional processing. This processing involves the following: 

1. For all A/R documents with scan line data, Code and Edit compares the 
check information to the A/R document. If in agreement, the A/R document 
and check are batched and sent to the deposit activity, using the NCR 
scanner, for deposit of the check and processing of the A/R document. 
Following scanning and deposit, the transaction is sent to the Data Repair 
unit for keying of the bill number and any other data not recognized during 
the scanning process. Once the A/R has been processed thru Data Repair, 
the payment can be applied to the taxpayers account. 

2. For all A/R documents without a scan line present, Code and Edit will look to 
see if the check has period/tax information or the taxpayers account is 
reviewed to ensure we know the true tax period or tax type. After the tax 
type and tax period information is determined, the A/R document and check 
is batched and forwarded to normal processing using the NCR scanner 
system. Following scanning and deposit, the transaction is sent to the Data 
Repair unit for keying of the bill number and any other data not recognized 
during the scanning process. Once the A/R has been processed thru Data 
Repair, the payment can be applied to the taxpayers account. 
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3. If the incoming check indicates the payment is for multiple tax periods or 
that it can not be determined what the payment is to be applied against, a 
copy of the check and correspondence (if any) is copied and transmitted to 
Compliance for proper posting information. Once Compliance has identified 
the correct posting information, Code and Edit will apply the payment based 
on the information supplied. These payments are treated as a Key Punch 
documents defined below. 

Payments mailed to PO Box 37759 are picked up by Compliance which 
subsequently provides the checks along with Payment Posting Vouchers (PPV) to 
define the proper allocation or tax period/tax type information to be associated with 
the check. Payment posting vouchers are received in the RPA receiving room and 
then controlled to Code and Edit. PPV's are processed using a procedure called 
"Key Punch". Key Punch processing involves keying data from the PPV into a 
system that produces a hard copy document which is submitted from processing, 
with the check attached thru Document Prep unit, into the Scanning unit, via 
Banktec scanners, back to the deposit activity and then into data repair all prior to 
posting of the money to the taxpayers account. 
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Proposed Processing Procedures: 

1. Change Receipt and Control MOTR to provide instructions requiring RPA 
to pick up from all Post Office boxes including PO Box 37759. 

2. Payments received in PO Box 37759 will be merged with payments picked up 
from PO Box 419, PO Box 556, and the 941 North Capitol St address and 
subjected to normal extraction and sorting. All mail addressed to a specific 
person or regarding a specific case will be copied and forwarded to 
Compliance. 

3. The extraction and sorting unit with RPA will assign PO Box 37759 mail as 
one of its first priorities each day. 

4. Change the Code and Edit MOTR to indicate that checks and the 
attachments are forwarded to Code and Edit Unit who will use the following 
procedures: 

a. For all A/R documents with scan line data, Code and Edit compares 
the check information to the A/R document. If in agreement, the A/R 
document and check are batched and sent to the deposit activity, 
using the NCR scanner, for deposit of the check and processing of the 
A/R document. Following scanning and deposit, the transaction is 
sent to the Data Repair unit for keying of the bill number and any 
other data not recognized during the scanning process. Once the A/R 
has been processed thru Data Repair, the payment can be applied to 
the taxpayers account. 

b. For all A/R documents without a scan line present, Code and Edit will 
look to see if the check has period/tax information or the taxpayers 
account is reviewed to ensure we know the true tax period or tax type. 
After the tax type and tax period information is determined, the A/R 
document and check is batched and forwarded to normal processing 
using the NCR scanner system. Following scanning and deposit, the 
transaction is sent to the Data Repair unit for keying of the bill 
number and any other data not recognized during the scanning 
process. Once the A/R has been processed thru Data Repair, the 
payment can be applied to the taxpayers account. 

c. If the incoming check indicates the payment is for multiple tax 
periods or that it can not be determined what the payment is to be 
applied against, a copy of the check and correspondence (if any) is 
copied and transmitted to Compliance for proper posting 
information. An aging log will be noted to record the taxpayer's 
name and the date the copies were sent to Compliance. This log will 
be reviewed daily and any request older than three business days will 
be elevated to the Director or Deputy Director of Compliance. Once 
Compliance has identified the correct posting information, Code and 
Edit will apply the payment based on the information supplied. If the 
payment has been identified to one specific tax period or tax type and 
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if the profile exists within IDCS, the payment will be processed using 
a D40P, D20/30P etc. If there is not a profile for the tax year 
specified, the payment will be processed using Key Punch procedures. 

d. If the incoming check indicates or Code and Edit research determines 
that the check is to cover multiple tax periods within one tax type, the 
payment will be applied using a "P" document for the oldest tax 
period and allowing the system to offset any overage to more current 
tax periods. 

e. For all cases where the payment can be associated with a single tax 
account and where profiles exist, "P" documents will be used in lieu of 
key punch documents. 

To ensure timely processing of checks received from PO Box 37759, RPA will 
follow the 48 hour deposit cycle policy which specifies the length of time allowed for 
each unit to process checks (see attached diagram). The 48 hour deposit time frame 
represents payments that do not require Compliance research. 



